# (L1) Ensure password protection is enabled for on-prem Active Directory

Microsoft Entra password protection is enabled for on-premises Active Directory and runs in enforced mode.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Password protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.3
```

## Overview

Microsoft Entra password protection is enabled for on-premises Active Directory and runs in enforced mode.

Hybrid environments allow password changes against domain controllers. Without the on-premises integration, those changes bypass the banned password lists, so users can set passwords that the cloud would reject. Password spraying tries a few common passwords against many accounts, and the banned password list is what stops those passwords from being set. In audit mode, banned passwords are only logged and are still accepted.

The setting does not take effect until the password protection proxy service and the domain controller agent are installed. If your tenant has no on-premises Active Directory, this recommendation does not apply.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Password protection**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection).
3. Set **Enable password protection on Windows Server Active Directory** to **Yes**.
4. Set **Mode** to **Enforced**. Use **Audit** first if you want to measure impact before enforcing.
5. Select **Save**.
6. Install the Microsoft Entra password protection proxy and domain controller agent on-premises if they are not deployed yet.

#### Related links

* [Microsoft Entra admin center - Password protection](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)
* [Plan and deploy on-premises Microsoft Entra Password Protection](https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy)
* [Enforce on-premises Microsoft Entra Password Protection](https://learn.microsoft.com/entra/identity/authentication/concept-password-ban-bad-on-premises)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.3](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Related products | Active Directory |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.3, nist-800-53-r5:IA-5(1) |
| PowerShell test | [Test-MtCisPasswordProtectionOnPremises](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.3.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.3.md)